CVE-2025-33109
📋 TL;DR
IBM i operating systems versions 7.2 through 7.6 contain a database authority check vulnerability that allows unauthorized execution of database procedures or functions. Attackers with some database access could escalate privileges or cause denial of service. This affects all IBM i users running vulnerable versions.
💻 Affected Systems
- IBM i
📦 What is this software?
I by Ibm
I by Ibm
I by Ibm
I by Ibm
I by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation allowing unauthorized database operations, data manipulation, and potential denial of service affecting critical database functions.
Likely Case
Unauthorized execution of specific database procedures/functions leading to data integrity issues, information disclosure, and limited service disruption.
If Mitigated
Minimal impact if proper database access controls and monitoring are implemented, though vulnerability still exists at the system level.
🎯 Exploit Status
Exploitation requires some database access credentials. The vulnerability is in database authority checking logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply IBM i PTF Group SF99725 Level 36 or higher
Vendor Advisory: https://www.ibm.com/support/pages/node/7240410
Restart Required: Yes
Instructions:
1. Check current PTF level with DSPPTF. 2. Apply PTF Group SF99725 Level 36 or higher. 3. Restart the system as required. 4. Verify installation with DSPPTF.
🔧 Temporary Workarounds
Restrict Database Access
ibmiLimit database user permissions to minimum required and implement strict access controls.
GRTOBJAUT OBJ(library/object) OBJTYPE(*PGM) USER(user) AUT(*EXCLUDE)
WRKOBJOWN OBJ(library/*) OBJTYPE(*ALL)
🧯 If You Can't Patch
- Implement strict database access controls and principle of least privilege
- Monitor database activity logs for unauthorized procedure/function execution
🔍 How to Verify
Check if Vulnerable:
Check IBM i version with DSPSYSVAL QRMTSYS and verify PTF level with DSPPTFCheck Version:
DSPSYSVAL QRMTSYSVerify Fix Applied:
Verify PTF Group SF99725 Level 36 or higher is installed using DSPPTF📡 Detection & Monitoring
Log Indicators:
- Unauthorized database procedure/function execution attempts
- Database authority check failures
- Unexpected database service disruptions
Network Indicators:
- Unusual database connection patterns
- Increased database traffic from unauthorized users
SIEM Query:
source="ibm_i" AND (event_type="database_procedure_execution" OR event_type="authority_check_failure")